Download - 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004
![Page 1: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/1.jpg)
1
Hybrid Policies
CSSE 490 Computer SecurityMark Ardis, Rose-Hulman InstituteMarch 23, 2004
![Page 2: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/2.jpg)
2
Acknowledgements
Many of these slides came from Matt Bishop, author of Computer Security: Art and Science
![Page 3: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/3.jpg)
3
Overview
Chinese Wall Model Focuses on conflict of interest
CISS Policy Combines integrity and confidentiality
RBAC Base controls on job function
![Page 4: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/4.jpg)
4
Chinese Wall Model
Problem: Tony advises American Bank about
investments He is asked to advise Toyland Bank
about investments Conflict of interest to accept,
because his advice for either bank would affect his advice to the other bank
![Page 5: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/5.jpg)
5
Organization
Organize entities into “conflict of interest” classes
Control subject accesses to each class
Control writing to all classes to ensure information is not passed along in violation of rules
Allow sanitized data to be viewed by everyone
![Page 6: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/6.jpg)
6
Definitions
Objects: items of information related to a company
Company dataset (CD): contains objects related to a single company Written CD(O)
Conflict of interest class (COI): contains datasets of companies in competition Written COI(O) Assume: each object belongs to exactly one
COI class
![Page 7: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/7.jpg)
7
Example
Bank of America
Citibank Bank of the West
Bank COI Class
Shell Oil
Union ’76
Standard Oil
ARCO
Gasoline Company COI Class
![Page 8: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/8.jpg)
8
Temporal Element
If Anthony reads any CD in a COI, he can never read another CD in that COI Possible that information learned
earlier may allow him to make decisions later
Let PR(S) be set of objects that S has already read
![Page 9: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/9.jpg)
9
CW-Simple Security Condition
s can read o iff either condition holds:1. There is an o´ such that s has accessed o´
and CD(o´) = CD(o)– Meaning s has read something in o’s
dataset
2. For all o´ O, o´ PR(s) COI(o´) ≠ COI(o)– Meaning s has not read any objects in o’s
conflict of interest class
Ignores sanitized data (see below) Initially, PR(s) = , initial read request
granted
![Page 10: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/10.jpg)
10
Sanitization
Public information may belong to a CD As is publicly available, no conflicts of
interest arise So, should not affect ability of analysts to
read Typically, all sensitive data removed from
such information before it is released publicly (called sanitization)
Add third condition to CW-Simple Security Condition:
3. o is a sanitized object
![Page 11: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/11.jpg)
11
Writing
Anthony, Susan work in same trading house Anthony can read Bank 1’s CD, Gas’ CD Susan can read Bank 2’s CD, Gas’ CD If Anthony could write to Gas’ CD, Susan
can read it Hence, indirectly, she can read
information from Bank 1’s CD, a clear conflict of interest
![Page 12: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/12.jpg)
12
CW-*-Property
s can write to o iff both of the following hold:
1. The CW-simple security condition permits s to read o; and
2. For all unsanitized objects o´, if s can read o´, then CD(o´) = CD(o)
Says that s can write to an object if all the (unsanitized) objects it can read are in the same dataset
![Page 13: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/13.jpg)
13
Compare to Bell-LaPadula
Fundamentally different CW has no security labels, B-LP does CW has notion of past accesses, B-LP does not
Bell-LaPadula can capture state at any time Each (COI, CD) pair gets security category Two clearances, S (sanitized) and U
(unsanitized) S dom U
Subjects assigned clearance for compartments without multiple categories corresponding to CDs in same COI class
![Page 14: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/14.jpg)
14
Compare to Bell-LaPadula
Bell-LaPadula cannot track changes over time Susan becomes ill, Anna needs to take over
C-W history lets Anna know if she can No way for Bell-LaPadula to capture this
Access constraints change over time Initially, subjects in C-W can read any object Bell-LaPadula constrains set of objects that a
subject can access Can’t clear all subjects for all categories,
because this violates CW-simple security condition
![Page 15: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/15.jpg)
15
Compare to Clark-Wilson
Clark-Wilson Model covers integrity, so consider only access control aspects
If “subjects” and “processes” are interchangeable, a single person could use multiple processes to violate CW-simple security condition Would still comply with Clark-Wilson Model
If “subject” is a specific person and includes all processes the subject executes, then consistent with Clark-Wilson Model
![Page 16: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/16.jpg)
16
Clinical Information Systems Security Policy
Intended for medical records Conflict of interest not critical problem Patient confidentiality, authentication of
records and annotators, and integrity are Entities:
Patient: subject of medical records (or agent) Personal health information: data about
patient’s health or treatment enabling identification of patient
Clinician: health-care professional with access to personal health information while doing job
![Page 17: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/17.jpg)
17
Assumptions and Principles
Assumes health information involves 1 person at a time Not always true; OB/GYN involves
father as well as mother Principles derived from medical
ethics of various societies, and from practicing clinicians
![Page 18: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/18.jpg)
18
Access
Principle 1: Each medical record has an access control list naming the individuals or groups who may read and append information to the record. The system must restrict access to those identified on the access control list. Idea is that clinicians need access, but
no-one else. Auditors get access to copies, so they cannot alter records
![Page 19: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/19.jpg)
19
Access
Principle 2: One of the clinicians on the access control list must have the right to add other clinicians to the access control list. Called the responsible clinician
![Page 20: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/20.jpg)
20
Access
Principle 3: The responsible clinician must notify the patient of the names on the access control list whenever the patient’s medical record is opened. Except for situations given in statutes, or in cases of emergency, the responsible clinician must obtain the patient’s consent. Patient must consent to all treatment,
and must know of violations of security
![Page 21: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/21.jpg)
21
Access
Principle 4: The name of the clinician, the date, and the time of the access of a medical record must be recorded. Similar information must be kept for deletions. This is for auditing. Don’t delete
information; update it (last part is for deletion of records after death, for example, or deletion of information when required by statute). Record information about all accesses.
![Page 22: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/22.jpg)
22
Creation
Principle: A clinician may open a record, with the clinician and the patient on the access control list. If the record is opened as a result of a referral, the referring clinician may also be on the access control list. Creating clinician needs access, and
patient should get it. If created from a referral, referring clinician needs access to get results of referral.
![Page 23: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/23.jpg)
23
Deletion
Principle: Clinical information cannot be deleted from a medical record until the appropriate time has passed. This varies with circumstances.
![Page 24: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/24.jpg)
24
Confinement
Principle: Information from one medical record may be appended to a different medical record if and only if the access control list of the second record is a subset of the access control list of the first. This keeps information from leaking to
unauthorized users. All users have to be on the access control list.
![Page 25: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/25.jpg)
25
Aggregation
Principle: Measures for preventing the aggregation of patient data must be effective. In particular, a patient must be notified if anyone is to be added to the access control list for the patient’s record and if that person has access to a large number of medical records. Fear here is that a corrupt investigator may
obtain access to a large number of records, correlate them, and discover private information about individuals which can then be used for nefarious purposes (such as blackmail)
![Page 26: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/26.jpg)
26
Enforcement
Principle: Any computer system that handles medical records must have a subsystem that enforces the preceding principles. The effectiveness of this enforcement must be subject to evaluation by independent auditors. This policy has to be enforced, and the
enforcement mechanisms must be auditable (and audited)
![Page 27: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/27.jpg)
27
Compare to Bell-LaPadula
Confinement Principle imposes lattice structure on entities in model Similar to Bell-LaPadula
CISS focuses on objects being accessed; B-LP on the subjects accessing the objects May matter when looking for insiders in
the medical environment
![Page 28: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/28.jpg)
28
Compare to Clark-Wilson
CDIs are medical records TPs are functions updating records, access control
lists IVPs certify:
A person identified as a clinician is a clinician; A clinician validates, or has validated,
information in the medical record; When someone is to be notified of an event, such
notification occurs; and When someone must give consent, the operation
cannot proceed until the consent is obtained Auditing (CR4) requirement: make all records
append-only, notify patient when access control list changed
![Page 29: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/29.jpg)
29
Role-Based Access Control (RBAC)
Access depends on function, not identity Example: Allison is bookkeeper for Math
Dept. She has access to financial records. If she leaves and Betty is hired as the new bookkeeper, Betty now has access to those records. The role of “bookkeeper” dictates access, not the identity of the individual.
![Page 30: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/30.jpg)
30
Definitions
Role r: collection of job functions trans(r): set of authorized transactions for r
Active role of subject s: role s is currently in actr(s)
Authorized roles of a subject s: set of roles s is authorized to assume authr(s)
canexec(s, t) iff subject s can execute transaction t at current time
![Page 31: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/31.jpg)
31
Axioms
Let S be the set of subjects and T the set of transactions.
The rule of role assignment is (sS)(tT)[canexec(s, t)actr(s) ≠ ]. If s can execute a transaction, it has a role This ties transactions to roles
The rule of role authorization is (sS)[actr(s)authr(s)]. Subject must be authorized to assume an
active role (otherwise, any subject could assume any role)
![Page 32: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/32.jpg)
32
Axiom
The rule of transaction authorization is (sS)(tT)
[canexec(s, t) t trans(actr(s))]. If a subject s can execute a transaction,
then the transaction is an authorized one for the role s has assumed
![Page 33: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/33.jpg)
33
Containment of Roles
Trainer can do all transactions that trainee can do (and then some). This means role r contains role r´ (r > r´). So:(s S)[ r´ authr(s) r > r´ r
authr(s) ]
![Page 34: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/34.jpg)
34
Separation of Duty
Let r be a role, and let s be a subject such that r auth(s). Then the predicate meauth(r) (for mutually exclusive authorizations) is the set of roles that s cannot assume because of the separation of duty requirement.
Separation of duty:(r1, r2 R) [ r2 meauth(r1)
[ (s S) [ r1 authr(s) r2 authr(s) ] ] ]
![Page 35: 1 Hybrid Policies CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 23, 2004](https://reader036.vdocuments.site/reader036/viewer/2022062313/56649d555503460f94a33356/html5/thumbnails/35.jpg)
35
Key Points
Hybrid policies deal with both confidentiality and integrity Different combinations of these
ORCON model neither MAC nor DAC Actually, a combination
RBAC model controls access based on functionality